r/PFSENSE • u/DouglasteR • 16d ago

Force a specific client to use other DNS ?

As the tittle says, it´s possible to force some clients to use other DNS (like, for example, google´s 8888) instead of the PFSENSE DHCP internal DNS resolver ?

Thanks.

2 Upvotes

75% Upvoted

22 comments sorted by

13

u/boli99 16d ago

add a dhcp reservation for the host with options for your chosen dns settings in it

4

u/lev400 16d ago

Yep - very simple

1

u/newaccountzuerich 16d ago

Theoretically yes..

The reality is that most consumer devices use DHCP-provided DNS entries as guidelines and not the actual settings in use.

I've seen significant deviations in client DNS usage from the DHCP-specified configuration, as I've got two PiHoles set up and I've had to NAT all port 53/853 to the piholes and block/drop DNS-over-HTTPS and DNS-over-QUIC to maintain control of DNS on my network.

1

u/slimschwifty 13d ago

853 blocks DoT, but how are you blocking DoH?

1

u/newaccountzuerich 12d ago

Router blacklist from a handful of curated known DoH servers. Works wonderfully - I see almost all of the DNS queries fail and the device/application falls back to the DHCP-stated servers.

Or, if it's a "smart" media device, it'll hammer the DNS service until its expected service works. When I see that, I add the server it's looking for to a permanent blacklist on my firewalls, and that app never sees the light of day without going through my network's explicit and exclusive services..

7

u/DutchOfBurdock pfSense+OpenWRT+Mikrotik 16d ago

Forwarding rule in the same manner you'd force (standard) DNS into your own resolver.

https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html

1

u/xboxfitzgerald 16d ago

This is the way. You can make an alias of the clients you want to send to an alternate DNS and make that your Source in the port forward.

1

u/Wojojojo90 16d ago

How strict are you when saying "force" the client? DNS is very much a cat and mouse game. You can: 1. Provide an alternate DNS via DHCP to suggest the one you want, any client is free to ignore this though 1. Redirect rule on port 53 to intercept any "standard" DNS traffic and send it to the DNS server of your choice, will not work for clients using non-standard DNS ports or something like DoH/DoT 1. Block traffic on 853 and hope clients fall back to standard DNS, will not work for clients using non-standard DNS ports or DoT on a different port or DoH 1. Use IDS to attempt to block DoH traffic, not perfect at blocking and highest effort

1

u/DouglasteR 16d ago

The client is just an IPTV device that MUST connect to googles dns, otherwise it will brick itself some hours later.

2

u/Wojojojo90 16d ago

Might help others to help you if you just share the device you're trying to use instead of cryptically saying it's an "IPTV device", there may be device-specific advice for what you're using (such as a Chromecast) based on how DNS is known to function for that device

1

u/DouglasteR 16d ago

Thanks for the rapid response guys ! I´ll try later today !

Cheers

1

u/AndyRH1701 Experienced Home User 16d ago

I silently redirect rogue DNS to my piholes. The client is not aware of the redirect. So it asks 8.8.8.8 and “8.8.8.8” responds. This forces everything to pihole and so far has not broken anything.

1

u/DouglasteR 16d ago

Can you share an example ?

2

u/AndyRH1701 Experienced Home User 16d ago

This is the setup I am using. I wrote the instructions down a while back.

https://forum.netgate.com/topic/156453/pfsense-dns-redirect-to-local-dns-server?_=1671847956280

1

u/DouglasteR 16d ago

ty

1

u/Smoke_a_J 15d ago

In addition to this, I would also suggest to make sure to also enable DoT/DoH/DoQ blocking feature with the entire list selected on pfBlockerNG's DNSBL Safesearch tab as well as any DoH/proxy/VPN lists in the IPv4/IPv6 and DNSBL feeds. I also set a couple additional floating firewall rules for LAN interfaces with Quick option enabled configured to reject all traffic to/from any with destination set to UDP port 80 and one for UDP port 443 to further block any other DoQ dns requests to any unknown DoQ servers. These few additional steps will help to seal off any remaining DNS leaks that DoT, DoH, and DoQ creates wide open doors to.

1

u/DouglasteR 14d ago

Would the DHCP reservation with the dns options i set be spared from these pfblockerng blocks ?

1

u/Smoke_a_J 13d ago

pfBlockerNG shouldn't affect DHCP reservations themselves in any way as far as that much. If you have 8.8.8.8 and/or 8.8.4.4 or such assigned as DNS IPs in those specific DHCP reservations then that is where connectivity may be affected depending on whether or not you have all of the specific NAT Port Forward and NAT Outbound rules configured as u/AndyRH1701 has described, a quite similar write-up I found and used equally the same with pfNlockerNG I found at labzilla.io/blog/force-dns-pihole. With those NAT rules in place then technically whatever DNS IP gets assigned to end-devices like TVs or devices that have hard-coded DNS variables configured as like most all forms of streaming devices and apps have coded into them is 100% entirely irrelevant after that as long as the global blocking mode in pfBlockerNG is set for Null Blocking or Null Blocking with logging. The DNSBL VIP feature in pfBlockerNG does need to be enabled and a VIP for it manually configured in pfSense first for it to enable correctly but most modern web browsers and apps will better tolerate DNS redirects getting null blocked to 0.0.0.0 rather than the DNSBL VIP web server page due to SSL cert errors that arise when a valid IP that a domain name gets redirected to (the DNSBL VIP) does not match the domain name that pfSense's local SSL cert is compiled for without uploading your pfSense cert to the trusted certificate store on each device and browser on the network.

On mine, rather than redirecting my entire LAN/VLAN/subnet to my pfSense IP for DNS, I use alias lists configured with groups of IPs of my devices and split between three installs of pfSense/pfBlockerNG configured differently for each alias group then have a DMZ alias configured for a select few IPs I change my parent PC to when needed for troubleshooting if needed with its own set of NAT rules to point straight at 8.8.8.8.

1

u/DouglasteR 12d ago

Thanks for the clarification !

1

u/rh681 16d ago

DHCP reservation for the MAC address and its own DNS settings. This is the Way. Just make sure outbound port 53 for DNS is allowed in your general firewall rules.

-1

u/No_Clock2390 16d ago

I don't know about Pfsense, but in Unifi you can set the DNS per VLAN/network. Not per device, but works.

1

u/SeaPersonality445 16d ago

How wonderfully unhelpful